What’s Vulnerable › Products
SAP NetWeaver AS Java vulnerabilities
78 known vulnerabilities, 7 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.
Check whether your SAP NetWeaver AS Java version is affected
Exploited SAP NetWeaver AS Java vulnerabilities
- CVE-2017-12637 — SAP NetWeaver Directory Traversal Vulnerability
- CVE-2016-2388 — SAP NetWeaver Information Disclosure Vulnerability
- CVE-2016-2386 — SAP NetWeaver SQL Injection Vulnerability
- CVE-2020-6287 — SAP NetWeaver Missing Authentication for Critical Function Vulnerability
- CVE-2016-9563 — SAP NetWeaver XML External Entity (XXE) Vulnerability
- CVE-2016-3976 — SAP NetWeaver Directory Traversal Vulnerability
- CVE-2010-5326 — SAP NetWeaver Remote Code Execution Vulnerability
Latest SAP NetWeaver AS Java vulnerabilities
- CVE-2026-27674 — Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java) (CVSS 6.1)
- CVE-2026-23686 — CRLF Injection vulnerability in SAP NetWeaver Application Server Java (CVSS 3.4)
- CVE-2025-42919 — Information Disclosure vulnerability in SAP NetWeaver Application Server Java (CVSS 5.3)
- CVE-2025-42926 — Missing Authentication check in SAP NetWeaver Application Server Java (CVSS 5.3)
- CVE-2025-42978 — Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java (CVSS 3.5)
- CVE-2025-27431 — Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java (CVSS 5.4)
- CVE-2025-24869 — Information Disclosure vulnerability in SAP NetWeaver Application Server Java (CVSS 4.3)
- CVE-2025-0054 — Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java (CVSS 5.4)
- CVE-2025-0067 — Missing Authorization check in SAP NetWeaver Application Server Java (CVSS 6.3)
- CVE-2025-0057 — Cross-Site Scripting vulnerability in SAP NetWeaver AS JAVA (User Admin Application) (CVSS 4.8)
- CVE-2024-47582 — XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA (CVSS 5.3)
- CVE-2024-47592 — Information Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Application) (CVSS 5.3)
- CVE-2024-34688 — Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository) (CVSS 7.5)
- CVE-2024-28164 — Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures) (CVSS 5.3)
- CVE-2024-22127 — Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in) (CVSS 9.1)
- CVE-2024-24743 — XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures) (CVSS 7.5)
- CVE-2024-22126 — Cross Site Scripting vulnerability in SAP NetWeaver AS Java (User Admin Application) (CVSS 6.1)
- CVE-2023-42480 — Information Disclosure in NetWeaver AS Java Logon (CVSS 5.3)
- CVE-2023-42477 — Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application) (CVSS 6.5)
- CVE-2023-40309 — Missing Authorization check in SAP CommonCryptoLib (CVSS 9.8)
- CVE-2023-40308 — Memory Corruption vulnerability in SAP CommonCryptoLib (CVSS 7.5)
- CVE-2023-24526 — Improper Access Control in SAP NetWeaver AS Java (Classload Service) (CVSS 5.3)
- CVE-2022-41262 — (CVSS 6.1)
- CVE-2022-26103 — (CVSS 5.3)
- CVE-2022-22533 — (CVSS 7.5)